Third Party Risk Management-Subcontractor

Birlasoft; Karnataka; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

Birlasoft is seeking a seasoned Third-Party Risk Management professional in Karnataka, India. You will assess vendor risk across cybersecurity, data privacy, and compliance, and oversee onboarding, monitoring, and offboarding within a global vendor ecosystem.

The role requires hands-on security assessments, strong knowledge of frameworks such as ISO 27001, NIST, and SOC 2, and excellent stakeholder communication to drive effective risk mitigation.

Qualifications

• 6+ years in Third-Party Risk Management or related roles.
• Understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands-on with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross-region stakeholders.

Responsibilities

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end-to-end third-party lifecycle: onboarding, ongoing monitoring, issue management, and off-boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.

Skills

Vendor Risk Management

Cybersecurity Risk

Security Assessments

Data Protection

Stakeholder Communication

Global Vendors

Tools

GRC Tools

Job description

Title: Third Party Risk Management-Subcontractor

Area(s) of responsibility

Required Skills & Experience:

• 6+ years of experience in Third‑Party Risk Management, Vendor Risk, Cybersecurity Risk, IT Audit, or GRC roles.
• Strong understanding of the TPRM lifecycle and vendor risk frameworks.
• Hands‑on experience with security assessments and control testing.
• Knowledge of cybersecurity concepts, access controls, incident response, and data protection.
• Excellent analytical, documentation, and stakeholder communication skills.
• Experience working with global vendors and cross‑region stakeholders.

Key Responsibilities:

• Conduct inherent and residual risk assessments for vendors across cybersecurity, data privacy, operational, and compliance domains.
• Perform vendor due diligence during onboarding and periodic reviews.
• Review vendor‑provided evidence (SOC reports, ISO 27001, SIG, penetration test summaries, etc.).
• Assess vendor alignment with security frameworks such as ISO 27001, NIST, SOC 2, and HP internal security policies.
• Identify gaps, document findings, and recommend risk mitigation and remediation plans.
• Support compliance with global regulations (GDPR, data protection, internal audit requirements).
• Support the end‑to‑end third‑party lifecycle: onboarding, ongoing monitoring, issue management, and off‑boarding.
• Track vendor risks, remediation actions, and exceptions in GRC or risk management tools.
• Collaborate with Procurement, Legal, IT, Privacy, and Business stakeholders.
• Participate in internal audits, regulatory reviews, and risk governance forums.